Compute instance legacy metadata endpoint is disabled

Check ID: compute_instance_legacy_metadata_endpoint_disabled
Provider: Oracle Cloud (OCI)
Service: compute
Severity: HIGH
Categories: secrets, identity-access
Resource type: Instance

What this check verifies

OCI compute instance metadata service is configured so legacy IMDS v1 endpoints are disabled, requiring session-authorized IMDS v2 requests for metadata access

Risk

Enabled IMDS v1 permits unauthenticated metadata reads via local access or SSRF, compromising confidentiality of instance credentials, SSH keys, and custom data. Stolen tokens enable cloud API abuse, driving privilege escalation, lateral movement, and unauthorized changes that impact integrity.

Recommendation

Disable IMDS v1 and require IMDS v2 across all instances. Migrate applications to session-authorized requests and confirm image support. Enforce least privilege for instance principals, restrict untrusted processes from reaching 169.254.169.254, and monitor metadata access to provide defense in depth.

Remediation

CLI
Terraform
Dashboard steps

oci compute instance update --instance-id <instance-ocid> --instance-options '{"areLegacyImdsEndpointsDisabled": true}'

resource "oci_core_instance" "<example_resource_name>" {
  instance_options {
    are_legacy_imds_endpoints_disabled = true  # Critical: disables IMDSv1, allowing only IMDSv2
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_legacy_metadata_endpoint_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Compute instance has in-transit encryption enabled Compute instance has Secure Boot enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires